xfccparser

README

xfccparser: A parser for Envoy x-forwarded-client-cert

When Envoy terminates TLS, it sends along metadata about the client certificates in an x-forwarded-client-cert HTTP header. This library parses that header into Go structs.

Usage

var req *http.Request

xfccHeader := req.Header.Get(xfccparser.ForwardedClientCertHeader)
clientCerts, err := xfccparser.ParseXFCCHeader(xfccHeader)

Contributions

Thanks to Alec Thomas for help with the participle representation.

Documentation

Index

• Constants
• func ParseSubject(subject string) (*pkix.Name, error)
• type ClientCert
  • func ParseXFCCHeader(header string) ([]*ClientCert, error)

Constants

const (
	// ForwardedClientCertHeader is the name of the HTTP header Envoy uses to pass metadata about certificates presented by a client
	ForwardedClientCertHeader = "x-forwarded-client-cert"
)

Functions

func ParseSubject

func ParseSubject(subject string) (*pkix.Name, error)

ParseSubject parses the subject string that is parse of the x-forwarded-client-cert header

Types

type ClientCert

type ClientCert struct {
	By         string
	Hash       string
	Cert       string
	Chain      string
	Subject    *pkix.Name
	SubjectRaw string
	URI        []string
	DNS        []string
}

ClientCert is a client certificate passed to Envoy

func ParseXFCCHeader

func ParseXFCCHeader(header string) ([]*ClientCert, error)

ParseXFCCHeader parses an x-forwarded-client-cert header and returns the list of certificates present. The format of the header is documented here: https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_conn_man/headers#x-forwarded-client-cert